High · 7.5 CVE-2026-106971 EUVD-2026-112134GHSA-w6qp-mj4x-9485

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a den…

Published Oct 28, 2026 · Updated Nov 3, 2026 · Assigned by mitre

Description

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the application runs on 32-bit PHP

References

https://github.com/rybakit/msgpack.php
https://github.com/rybakit/msgpack.php/releases/tag/v0.11.0
https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106971.md